Researchers reveal VoIP vulnerabilities

Share this article:
VoIPshield Laboratories has alerted companies that market voice over IP systems of new security vulnerabilities.

The VoIP vulnerabilities, if successfully exploited, could affect brand reputation, internal productivity, and competitive advantage, researchers said.

VoIPshield does not reveal specifics about the vulnerabilities to the public, Bogdan Materna, VoIPshield Laboratories chief technology officer, told on Friday.

“We don't want to give hackers information to work from,” he said.

Instead, under its disclosure policy, VoIPshield works with the VoIP vendors to assist them in reproducing the vulnerabilities in their labs.

VoIPshield classifies the vulnerabilities into different categories -- remote code execution; unauthorized access; denial of service; and information harvesting – and rates them according to their severity.

Materna said that by passing the information of their vulnerability research, the company hopes that vendors will be able to take action to create patches for potential exploits. Avaya, Cisco and Nortel have acknowledged the latest vulnerabilities on their websites, and are issuing their own security advisories.

VoIP vulnerabilities appear to be increasing because more security researchers are focused on finding them, Lawrence Orans of Gartner told

“Three to four years ago, there was far less focus on IP telephony vulnerabilities because the IP telephony installed base was much smaller,” Orans said. "In 2008, most of the widely deployed telephony systems have vulnerabilities that permit DOS attacks, privilege escalation and code execution attacks."

Because of these risks, he added, managers should scan their applications for vulnerabilities on a regular basis and prioritize software patches that resolve critical vulnerabilities.

Share this article:

Sign up to our newsletters

More in News

Brazilian president signs internet 'Bill of Rights' into law

Brazilian president signs internet 'Bill of Rights' into ...

President Dilma Rousseff signed the legislation on Wednesday at the NetMundial conference in Sao Paulo.

Android trojan sends premium SMS messages, targets U.S. users for first time

Android trojan sends premium SMS messages, targets U.S. ...

An SMS trojan for Android, known as FakeInst, has been observed sending premium SMS messages to users all over the world, including, for the first time, the United States.

Report: DDoS up in Q4 2013, vulnerability scanners leveraged to exploit sites

Report: DDoS up in Q4 2013, vulnerability scanners ...

Researchers observed 346 DDoS attacks in the final quarter of 2013 and attackers used Vega and Skipfish vulnerability scanners to exploit web flaws at financial companies.